In my experience, the only thing that really made them more difficult than managing end users who were using an authentication app instead was having to facilitate getting the fob to the users and replacing them occasionally and they were dirt cheap… Like less than $5 apiece.